build(deps): bump the python-dependencies group, migrating the LLM SDKs to httpx2

[richardmhope]

Summary

Supersedes the grouped dependabot PR #327, which could not merge as-is.

#327 bundled seven routine bumps with two majors that CI rejected: anthropic 0.120.2 → 1.x and openai 2.51.0 → 3.x are built on httpx2 rather than httpx. The LLM adapters hand those SDKs an http_client= for outbound proxying (#97), so the bump turned that into a type error and the test job failed on pyright:

app/services/llm/openai_provider.py:63:25 - error: Argument of type "AsyncClient | None"
  cannot be assigned to parameter "http_client" of type "AsyncClient | None"
  Type "httpx._client.AsyncClient | None" is not assignable to type "httpx2._client.AsyncClient | None"

This PR carries the same group of upgrades plus the code change that makes them land.

What changed

• Both LLM adapters now build an httpx2.AsyncClient for the proxy path. The proxy contract is untouched — resolve_kwargs() still returns proxy / trust_env, spelled identically in both libraries, and still returns {} when the cache is unloaded so the SDK builds its own default client.
• httpx2 arrives with the provider SDK and is never a core dependency, so it is imported lazily inside _http_client() — the adapter modules themselves import eagerly (to register), and a deployment without an llm-* extra has neither the SDK nor httpx2.
• OIDC (Authlib) and the SIEM http sink are unaffected and stay on httpx.
• The llm-* extras now floor at the first httpx2-era majors (anthropic>=1.2.0, openai>=3.6.0) so a fresh install cannot resolve an SDK that would reject an httpx2 client.
• PLAN.md § Outbound proxy records the httpx/httpx2 split.

Bumps: alembic 1.18.5→1.19.2, anthropic 0.120.2→1.4.0, authlib 1.7.2→1.8.0, openai 2.51.0→3.9.0, playwright 1.61.0→1.62.0, pydantic-settings 2.14.2→2.15.0, pytest-playwright 0.8.0→0.9.0, ruff 0.16.1→0.16.6, sqlmodel 0.0.39→0.0.42.

Related issue

n/a — dependency maintenance; supersedes #327.

Type of change

• Bug fix
• New feature
• Documentation
• Refactor / tech debt
• Other — dependency upgrade + the migration it requires

Checklist

• ruff check app/ tests/ passes
• pytest passes locally (838 passed — see note below)
• Added or updated tests for the change — the existing wiring tests in tests/test_proxy.py already cover this seam and assert on behaviour (http_client is not None / is None), not on the client class, so they pass unchanged and still pin the contract
• No template/CSS/JS changes, so no Tailwind rebuild needed
• No DB schema change, so no Alembic migration
• Updated docs (PLAN.md § Outbound proxy)

Notes for reviewers

Verified locally on Python 3.14.7 (matching CI) against a real Postgres: uv lock --check, ruff, pyright app/ (0 errors — the exact failure #327 hit), bandit, and pytest.

Two caveats worth knowing:

• The suite reports 1 failed, 838 passed, 1 skipped under -n0 against a single shared external Postgres — test_effective_config_lists_every_setting_and_never_secret_values. That failure reproduces identically on pristine main (same counts), passes in isolation, and is unrelated to this change: it is an ordering artifact of -n0 on a shared DB rather than CI's container-per-xdist-worker setup.
• The Playwright ui job was not run locally (this sandbox cannot fetch the Chromium/Tailwind binaries). playwright 1.61→1.62 and pytest-playwright 0.8→0.9 are in this bump, so that job is the one thing here validated only by CI.

Once this merges, #327 is fully redundant and can be closed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AEwQQfnF8ceg8q1Hn9Y1gQ

---

Generated by Claude Code